Cisco – What do the parentheses “()” after objects mean in Cisco ASA ACLs

aclciscocisco-asa

I have encountered something I'm not familiar with in a customer's configuration, I know that the "(hitcnt=324165)" at the end of every rule in "show access-list" points to rule usage, hit count. But in this output of show access-list I'm also seeing numbers following object and non-object entities in the rule.

Example

access-list access-global-in line 5 extended deny ip object-group HA_Networks_All any log 
 informational interval 300 0xf688d263

access-list access-global-in line 5 extended deny ip object-group HA_Networks_All(298) any(65537) log 
 informational interval 300 (hitcnt=324165) 0xa2669c62

access-list access-global-in line 7 extended deny ip object-group HA-Wireless_10.1.80.0-24 any log 
 informational interval 300 0xb25caeed 

access-list access-global-in line 7 extended deny ip object-group HA-Wireless_10.1.80.0-24(299) 
 any(65537) log informational interval 300 (hitcnt=2133314) 0x111a2d28

Notice that the same rule is displayed twice (same line number) but once with the parentheses inside the rule and once without.

Is this some sort of object usage? If so how can it be different from the hit count? I couldn't find any documentation explaining this.

Best Answer

Great question! You're right in thinking that it is a function of your object-group.

You have ACL optimisation activated. This is activated via the global CLI command object-group-search access-control .

ACL optimisation collapses all the possible ACE combinations for source/destination addresses and ports back into your original objects. The numbers in parentheses are the amount of entries that have been collapsed into that single entry.

When ACL optimisation is disabled, the show access-list command will show you the expanded entries instead.

The object-group-search access-control command is service affecting and will drop connections while it is performing the algorithm.

Your ASA configuration:

route outside 0.0.0.0 0.0.0.0 172.16.1.1 1

This will provide a default route via the outside interface, but how will the ASA know how to reach subnets residing behind the Layer 3 Distribution Switch?

You'll need to add routes to the internal subnets via the inside interface using the Layer 3 Distribution Switch as the next-hop IP address.

ASA static routing example:

route inside 172.19.12.0 255.255.255.240 172.16.2.2
route inside 172.19.3.0 255.255.255.0 172.16.2.2
route inside 172.20.100.0 255.255.255.224 172.16.2.2

Your Cisco Router's configuration:

ip route 0.0.0.0 0.0.0.0 200.200.200.200

Additionally, how will your border router know how to reach subnets other than it's connected routes, and the catch all default route via the outside interface's next-hop address 200.200.200.200?

Router static routing example:

ip route 172.19.12.0 255.255.255.240 172.16.1.10
ip route 172.19.3.0 255.255.255.0 172.16.1.10
ip route 172.19.100.0 255.255.255.224 172.16.1.10
ip route 172.16.2.0 255.255.255.224 172.16.1.10

Vpn – ASA VPN communication issue

Your NAT Exemptions on the Spokes are messed up.

First, you have the Spoke 2 address as the source on Spoke 1, and you're missing Spoke 2 altogether:

ip access-list extended NONAT
deny   ip 192.168.210.64 0.0.0.31 172.16.0.0 0.0.255.255
permit ip 192.168.210.64 0.0.0.31 any

You need to have:

ip access-list extended NONAT
deny   ip 192.168.210.224 0.0.0.31 172.16.0.0 0.0.255.255
deny   ip 192.168.210.224 0.0.0.31 192.168.210.64 0.0.0.31
permit ip 192.168.210.224 0.0.0.31 any

And then on Spoke 2 you have the right source, but are just missing an entry for Spoke 1:

ip access-list extended NONAT
deny   ip 192.168.210.64 0.0.0.31 172.16.0.0 0.0.255.255
permit ip 192.168.210.64 0.0.0.31 any

This needs to have the Spoke 1 segment added as shown below:

ip access-list extended NONAT
deny   ip 192.168.210.64 0.0.0.31 172.16.0.0 0.0.255.255
deny   ip 192.168.210.64 0.0.0.31 192.168.210.224 0.0.0.31
permit ip 192.168.210.64 0.0.0.31 any